昨天 11:52 广东工业大学保险理赔发布于广东

关注

PHP安全防护实战指南：构筑抵御SQL注入与XSS攻击的坚固防线

在当今数字时代，PHP作为支撑全球超过70%网站的核心技术，其安全性直接影响着数亿用户的隐私与数据安全。SQL注入和跨站脚本（XSS）攻击长期位居OWASP十大安全威胁前列，每年造成数百亿美元的经济损失。本文将提供一套完整的PHP安全防护体系，从攻击原理到防御策略，从基础防护到高级实践，帮助开发者构筑坚不可摧的Web应用防线。

第一章：Web安全威胁全景与PHP安全生态

1.1 Web安全威胁的演变与现状

自互联网诞生以来，Web安全威胁经历了从简单的脚本攻击到复杂的供应链攻击的演变。SQL注入自1998年被首次公开披露以来，一直是数据库驱动的Web应用最致命的威胁之一。XSS攻击则随着Web 2.0的兴起而泛滥，特别是AJAX技术的普及使得反射型XSS攻击更加难以防范。

根据最新的安全研究报告，超过30%的Web应用存在SQL注入漏洞，而XSS漏洞的发现率更是高达60%。这些漏洞不仅威胁企业数据安全，更可能导致用户隐私泄露、网站被篡改甚至成为僵尸网络的一部分。

1.2 PHP安全开发生命周期

安全不应是开发流程的最后一步，而应贯穿整个开发生命周期：

设计阶段：威胁建模、安全需求分析、架构安全评审

开发阶段：安全编码规范、组件安全评估、代码审查

测试阶段：渗透测试、漏洞扫描、安全测试用例

部署阶段：安全配置、WAF部署、监控告警

运维阶段：漏洞管理、应急响应、持续监控

第二章：SQL注入攻击深度解析与全方位防御

2.1 SQL注入的攻击原理与变种

SQL注入的本质是攻击者通过精心构造的输入数据，欺骗应用程序执行非预期的SQL命令。攻击者利用这一漏洞，可以绕过身份验证、窃取敏感数据、篡改数据库内容，甚至在数据库服务器上执行系统命令。

攻击变种分类：

经典注入：基于布尔逻辑的注入攻击，通过AND、OR等逻辑运算符改变查询条件
联合查询注入：利用UNION操作符合并查询结果，获取其他表的数据
盲注攻击：通过布尔型或时间型盲注，在无法直接获取结果的情况下推断数据
堆叠查询注入：利用分号执行多个SQL语句，实现更复杂的攻击
二阶注入：将恶意输入先存储后执行，绕过即时防护

2.2 参数化查询：最根本的防御手段

参数化查询（预处理语句）是防御SQL注入的黄金标准。它将SQL代码与数据完全分离，确保用户输入始终被当作数据处理而非代码执行。

PDO（PHP Data Objects）最佳实践

php

<?php
class SecureDatabase {
    private $pdo;
    
    public function __construct($dsn, $username, $password) {
        // 连接数据库，设置错误处理模式为异常
        $this->pdo = new PDO($dsn, $username, $password, [
            PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
            PDO::ATTR_EMULATE_PREPARES => false, // 禁用模拟预处理，使用真正的预处理
            PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
            PDO::MYSQL_ATTR_INIT_COMMAND => "SET NAMES utf8mb4"
        ]);
    }
    
    /**
     * 安全的参数化查询示例
     */
    public function getUserByCredentials($username, $password) {
        try {
            // 使用命名参数的预处理语句
            $stmt = $this->pdo->prepare(
                "SELECT id, username, email, role FROM users 
                 WHERE username = :username 
                 AND password_hash = SHA2(CONCAT(:password, salt), 256)
                 AND active = 1"
            );
            
            // 绑定参数，明确指定数据类型
            $stmt->bindValue(':username', $username, PDO::PARAM_STR);
            $stmt->bindValue(':password', $password, PDO::PARAM_STR);
            
            // 执行查询
            $stmt->execute();
            
            // 获取结果
            return $stmt->fetch();
        } catch (PDOException $e) {
            // 生产环境中应记录日志，但不暴露详细信息
            error_log("Database error: " . $e->getMessage());
            return null;
        }
    }
    
    /**
     * IN语句的参数化处理
     */
    public function getUsersByIds($ids) {
        if (empty($ids)) {
            return [];
        }
        
        // 为每个ID创建命名参数
        $placeholders = [];
        $params = [];
        
        foreach ($ids as $i => $id) {
            $paramName = ':id_' . $i;
            $placeholders[] = $paramName;
            $params[$paramName] = (int)$id; // 强制类型转换
        }
        
        $sql = "SELECT id, username FROM users WHERE id IN (" 
                . implode(',', $placeholders) . ")";
        $stmt = $this->pdo->prepare($sql);
        
        foreach ($params as $param => $value) {
            $stmt->bindValue($param, $value, PDO::PARAM_INT);
        }
        
        $stmt->execute();
        return $stmt->fetchAll();
    }
}
?>

MySQLi预处理语句实现

php

<?php
class MySQLiSecurity {
    private $mysqli;
    
    public function __construct($host, $user, $pass, $db) {
        $this->mysqli = new mysqli($host, $user, $pass, $db);
        
        if ($this->mysqli->connect_error) {
            throw new Exception('Connection failed: ' . $this->mysqli->connect_error);
        }
        
        // 设置字符集
        $this->mysqli->set_charset('utf8mb4');
    }
    
    /**
     * 使用MySQLi预处理语句进行安全查询
     */
    public function searchProducts($keyword, $categoryId, $minPrice) {
        // 使用参数化查询
        $stmt = $this->mysqli->prepare(
            "SELECT id, name, price, description 
             FROM products 
             WHERE name LIKE CONCAT('%', ?, '%')
             AND category_id = ?
             AND price >= ?
             AND deleted = 0"
        );
        
        if (!$stmt) {
            throw new Exception('Prepare failed: ' . $this->mysqli->error);
        }
        
        // 绑定参数（'sid'表示字符串、整数、双精度浮点数）
        $stmt->bind_param('sid', $keyword, $categoryId, $minPrice);
        
        // 执行查询
        $stmt->execute();
        
        // 获取结果
        $result = $stmt->get_result();
        $products = $result->fetch_all(MYSQLI_ASSOC);
        
        $stmt->close();
        return $products;
    }
    
    /**
     * 存储过程调用示例
     */
    public function callSecureProcedure($userId, $action) {
        $stmt = $this->mysqli->prepare("CALL user_audit_log(?, ?)");
        $stmt->bind_param('is', $userId, $action);
        $stmt->execute();
        $stmt->close();
    }
}
?>

2.3 输入验证与数据净化策略

多层验证体系

php

<?php
class InputValidator {
    /**
     * 白名单验证 - 最安全的验证策略
     */
    public static function validateByWhitelist($input, $allowedValues) {
        return in_array($input, $allowedValues, true);
    }
    
    /**
     * 数据类型验证
     */
    public static function validateInteger($value, $min = null, $max = null) {
        if (!filter_var($value, FILTER_VALIDATE_INT) && $value !== '0') {
            return false;
        }
        
        $intValue = (int)$value;
        
        if ($min !== null && $intValue < $min) {
            return false;
        }
        
        if ($max !== null && $intValue > $max) {
            return false;
        }
        
        return true;
    }
    
    /**
     * 电子邮件验证
     */
    public static function validateEmail($email) {
        $sanitized = filter_var($email, FILTER_SANITIZE_EMAIL);
        return filter_var($sanitized, FILTER_VALIDATE_EMAIL) 
               && $this->checkMXRecord($sanitized);
    }
    
    /**
     * SQL关键字检测（辅助防御）
     */
    public static function containsSQLKeywords($input) {
        $keywords = [
            'UNION', 'SELECT', 'INSERT', 'UPDATE', 'DELETE', 'DROP',
            'CREATE', 'ALTER', 'EXEC', 'EXECUTE', '--', '/*', '*/'
        ];
        
        $upperInput = strtoupper($input);
        
        foreach ($keywords as $keyword) {
            // 避免误报，检查关键词是否被其他字符包围
            if (preg_match('/\b' . preg_quote($keyword, '/') . '\b/', $upperInput)) {
                return true;
            }
        }
        
        return false;
    }
    
    /**
     * 安全搜索查询处理
     */
    public static function sanitizeSearchQuery($query) {
        // 移除SQL注释和危险字符
        $query = preg_replace('/(--|#|\/\*|\*\/)/', '', $query);
        
        // 限制长度
        $query = substr($query, 0, 100);
        
        // 仅允许字母、数字、空格和基本标点
        $query = preg_replace('/[^\p{L}\p{N}\s\-_\.,]/u', '', $query);
        
        return trim($query);
    }
}
?>

2.4 最小权限原则与数据库安全加固

sql

-- 创建应用程序专用数据库用户
CREATE USER 'app_user'@'localhost' IDENTIFIED BY 'StrongPassword123!';
GRANT SELECT, INSERT, UPDATE ON app_db.users TO 'app_user'@'localhost';
GRANT SELECT ON app_db.products TO 'app_user'@'localhost';
-- 注意：没有DROP、DELETE、ALTER权限

-- 创建存储过程封装敏感操作
DELIMITER //
CREATE PROCEDURE secure_user_login(
    IN p_username VARCHAR(50),
    IN p_password VARCHAR(255)
)
BEGIN
    SELECT id, username, email 
    FROM users 
    WHERE username = p_username 
    AND password_hash = SHA2(CONCAT(p_password, salt), 256)
    AND active = 1
    LIMIT 1;
END //
DELIMITER ;

-- 数据库层面的输入验证
CREATE TRIGGER validate_user_input 
BEFORE INSERT ON user_comments
FOR EACH ROW
BEGIN
    IF NEW.content REGEXP '(UNION|SELECT|--|/\*)' THEN
        SIGNAL SQLSTATE '45000' 
        SET MESSAGE_TEXT = 'Invalid input detected';
    END IF;
END;

2.5 Web应用防火墙（WAF）与运行时防护

php

<?php
class RuntimeSQLInjectionProtection {
    private static $patterns = [
        '/\bUNION\b.*\bSELECT\b/i',
        '/\bSELECT.*\bFROM\b/i',
        '/\bINSERT\s+INTO\b/i',
        '/\bUPDATE.*\bSET\b/i',
        '/\bDELETE.*\bFROM\b/i',
        '/\bDROP\b/i',
        '/\bALTER\b/i',
        '/\bCREATE\b/i',
        '/\/\*.*\*\//s',
        '/--\s+/',
        '/;\s*(SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER)/i'
    ];
    
    /**
     * 检查请求中的SQL注入迹象
     */
    public static function detectInRequest() {
        $requestData = array_merge($_GET, $_POST, $_COOKIE);
        
        foreach ($requestData as $key => $value) {
            if (is_array($value)) {
                continue;
            }
            
            foreach (self::$patterns as $pattern) {
                if (preg_match($pattern, $value)) {
                    // 记录安全事件
                    self::logSecurityEvent('sql_injection_attempt', [
                        'key' => $key,
                        'value' => substr($value, 0, 100),
                        'pattern' => $pattern,
                        'ip' => $_SERVER['REMOTE_ADDR']
                    ]);
                    
                    // 可以根据策略决定是否阻止请求
                    if (self::shouldBlockRequest()) {
                        header('HTTP/1.1 400 Bad Request');
                        exit('Invalid request detected');
                    }
                    
                    break 2;
                }
            }
        }
    }
    
    /**
     * 基于频率的请求阻止
     */
    private static function shouldBlockRequest() {
        $ip = $_SERVER['REMOTE_ADDR'];
        $key = 'sql_block_' . $ip;
        
        // 使用Redis或Memcached存储计数
        $attempts = self::getCache($key) ?: 0;
        $attempts++;
        
        if ($attempts >= 5) {
            return true; // 阻止该IP
        }
        
        self::setCache($key, $attempts, 300); // 5分钟窗口
        return false;
    }
}
?>

第三章：XSS攻击全面防御体系

3.1 XSS攻击类型与攻击向量分析

XSS攻击允许攻击者在用户浏览器中执行恶意脚本，主要分为三类：

反射型XSS：恶意脚本作为请求的一部分发送到服务器，然后立即在响应中返回并执行。通常通过钓鱼邮件或恶意链接传播。

存储型XSS：恶意脚本永久存储在服务器上（数据库、文件系统），当其他用户访问受影响页面时执行。危害最大，常见于论坛、评论系统。

DOM型XSS：客户端JavaScript直接操作DOM时引入的漏洞，不涉及服务器端处理。

3.2 输出编码：上下文敏感的防御策略

输出编码是防御XSS的核心，不同的输出上下文需要不同的编码策略。

php

<?php
class XSSProtector {
    /**
     * HTML上下文编码（用于标签内容）
     */
    public static function encodeForHTML($data) {
        return htmlspecialchars($data, ENT_QUOTES | ENT_SUBSTITUTE | ENT_HTML5, 'UTF-8');
    }
    
    /**
     * HTML属性上下文编码
     */
    public static function encodeForAttribute($data) {
        // 对于属性，需要额外注意
        $encoded = htmlspecialchars($data, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
        // 移除可能中断属性值的字符
        $encoded = preg_replace('/[\x00-\x1F\x7F]/', '', $encoded);
        return $encoded;
    }
    
    /**
     * JavaScript上下文编码
     */
    public static function encodeForJavaScript($data) {
        // 使用JSON编码，然后移除外层的引号
        return json_encode($data, JSON_HEX_TAG | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_HEX_AMP);
    }
    
    /**
     * URL上下文编码
     */
    public static function encodeForURL($data) {
        return urlencode($data);
    }
    
    /**
     * CSS上下文编码
     */
    public static function encodeForCSS($data) {
        // 移除危险字符并使用CSS转义
        $data = preg_replace('/[^\x20-\x7E]/', '', $data);
        return preg_replace_callback('/[^a-zA-Z0-9]/', function($matches) {
            return '\\' . dechex(ord($matches[0]));
        }, $data);
    }
    
    /**
     * 智能上下文感知编码
     */
    public static function smartEncode($data, $context = 'html') {
        switch ($context) {
            case 'html':
                return self::encodeForHTML($data);
            case 'attribute':
                return self::encodeForAttribute($data);
            case 'javascript':
                return self::encodeForJavaScript($data);
            case 'url':
                return self::encodeForURL($data);
            case 'css':
                return self::encodeForCSS($data);
            default:
                return self::encodeForHTML($data);
        }
    }
}
?>

3.3 内容安全策略（CSP）实施

CSP是现代浏览器提供的最有效的XSS防护机制之一。

php

<?php
class ContentSecurityPolicy {
    /**
     * 生成严格的CSP头部
     */
    public static function getStrictPolicy() {
        $policy = [
            "default-src 'self'",
            "script-src 'self' 'nonce-" . self::generateNonce() . "' https://trusted-cdn.com",
            "style-src 'self' 'nonce-" . self::generateNonce() . "'",
            "img-src 'self' data: https://*.example.com",
            "font-src 'self' https://fonts.gstatic.com",
            "connect-src 'self' https://api.example.com",
            "frame-src 'none'", // 禁止嵌入iframe
            "object-src 'none'", // 禁止Flash等插件
            "base-uri 'self'",
            "form-action 'self'",
            "frame-ancestors 'none'", // 防止点击劫持
            "block-all-mixed-content",
            "upgrade-insecure-requests"
        ];
        
        header("Content-Security-Policy: " . implode("; ", $policy));
    }
    
    /**
     * 生成一次性随机数
     */
    private static function generateNonce() {
        if (!isset($_SESSION['csp_nonce']) || empty($_SESSION['csp_nonce'])) {
            $_SESSION['csp_nonce'] = bin2hex(random_bytes(16));
        }
        return $_SESSION['csp_nonce'];
    }
    
    /**
     * 在HTML中应用nonce
     */
    public static function getNonceAttribute() {
        return 'nonce="' . self::generateNonce() . '"';
    }
}
?>

在模板中应用nonce

php+html

<script <?= ContentSecurityPolicy::getNonceAttribute() ?>>
// 只有带有正确nonce的内联脚本才会执行
var config = <?= XSSProtector::encodeForJavaScript($config) ?>;
</script>

<style <?= ContentSecurityPolicy::getNonceAttribute() ?>>
/* 内联CSS样式 */
</style>

3.4 安全的富文本处理策略

对于需要HTML输入的场景（如博客、论坛），需要采用白名单策略。

php

<?php
class HTMLSanitizer {
    private static $allowedElements = [
        'p' => ['class', 'style'],
        'br' => [],
        'strong' => [],
        'em' => [],
        'u' => [],
        'a' => ['href', 'title', 'target', 'rel'],
        'ul' => [],
        'ol' => ['start'],
        'li' => [],
        'img' => ['src', 'alt', 'title', 'width', 'height'],
        'blockquote' => ['cite'],
        'code' => ['class'],
        'pre' => ['class'],
        'h1' => [], 'h2' => [], 'h3' => [], 'h4' => [], 'h5' => [], 'h6' => []
    ];
    
    private static $allowedProtocols = [
        'http', 'https', 'mailto', 'ftp'
    ];
    
    /**
     * 使用HTML Purifier库进行清理
     */
    public static function purifyHTML($dirtyHTML) {
        require_once 'HTMLPurifier/HTMLPurifier.auto.php';
        
        $config = HTMLPurifier_Config::createDefault();
        $config->set('Core.Encoding', 'UTF-8');
        $config->set('HTML.Doctype', 'HTML 5');
        $config->set('HTML.Allowed', $this->generateAllowedHTMLConfig());
        $config->set('AutoFormat.RemoveEmpty', true);
        $config->set('AutoFormat.RemoveEmpty.RemoveNbsp', true);
        $config->set('URI.AllowedSchemes', [
            'http' => true, 
            'https' => true, 
            'mailto' => true
        ]);
        $config->set('URI.DisableExternalResources', true);
        $config->set('CSS.AllowedProperties', [
            'text-align', 'margin', 'padding', 'color', 
            'background-color', 'font-weight', 'font-style'
        ]);
        
        $purifier = new HTMLPurifier($config);
        return $purifier->purify($dirtyHTML);
    }
    
    /**
     * 自定义的轻量级清理器
     */
    public static function sanitize($html) {
        $dom = new DOMDocument();
        
        // 加载HTML，抑制错误
        libxml_use_internal_errors(true);
        $dom->loadHTML('<?xml encoding="UTF-8">' . $html, 
                      LIBXML_HTML_NOIMPLIED | LIBXML_HTML_NODEFDTD);
        libxml_clear_errors();
        
        // 移除所有脚本元素
        $scripts = $dom->getElementsByTagName('script');
        foreach ($scripts as $script) {
            $script->parentNode->removeChild($script);
        }
        
        // 移除事件处理器属性
        $xpath = new DOMXPath($dom);
        $nodes = $xpath->query('//@*[starts-with(name(), "on")]');
        foreach ($nodes as $node) {
            $node->parentNode->removeAttribute($node->nodeName);
        }
        
        // 清理href和src属性
        $attributes = ['href', 'src', 'action'];
        foreach ($attributes as $attr) {
            $nodes = $xpath->query('//@' . $attr);
            foreach ($nodes as $node) {
                $value = $node->nodeValue;
                if (!$this->isSafeURL($value)) {
                    $node->parentNode->removeAttribute($attr);
                }
            }
        }
        
        // 返回清理后的HTML
        return $dom->saveHTML();
    }
    
    private static function isSafeURL($url) {
        $parsed = parse_url($url);
        
        if (!isset($parsed['scheme'])) {
            // 相对URL通常是安全的
            return true;
        }
        
        return in_array(strtolower($parsed['scheme']), self::$allowedProtocols);
    }
}
?>

3.5 Cookie安全与HttpOnly、Secure标志

php

<?php
class SecureCookieManager {
    /**
     * 设置安全的Cookie
     */
    public static function setSecureCookie($name, $value, $expire = 0, $path = '/') {
        $options = [
            'expires' => $expire,
            'path' => $path,
            'domain' => $_SERVER['HTTP_HOST'],
            'secure' => true, // 仅通过HTTPS传输
            'httponly' => true, // JavaScript无法访问
            'samesite' => 'Strict' // 严格同站策略
        ];
        
        setcookie($name, $value, $options);
    }
    
    /**
     * 会话安全配置
     */
    public static function secureSession() {
        ini_set('session.cookie_httponly', 1);
        ini_set('session.cookie_secure', 1);
        ini_set('session.cookie_samesite', 'Strict');
        ini_set('session.use_strict_mode', 1);
        ini_set('session.sid_length', 128);
        ini_set('session.sid_bits_per_character', 6);
        
        // 自定义会话管理器
        session_set_save_handler(new SecureSessionHandler(), true);
        
        // 防止会话固定攻击
        session_start();
        if (!isset($_SESSION['initiated'])) {
            session_regenerate_id(true);
            $_SESSION['initiated'] = true;
        }
    }
}
?>

第四章：综合安全体系与最佳实践

4.1 安全的PHP配置

ini

; php.ini安全配置
expose_php = Off
display_errors = Off
log_errors = On
error_log = /path/to/secure/error.log

enable_dl = Off
allow_url_fopen = Off
allow_url_include = Off

session.use_cookies = 1
session.use_only_cookies = 1
session.cookie_httponly = 1
session.cookie_secure = 1

upload_max_filesize = 10M
post_max_size = 12M
max_file_uploads = 5

4.2 安全的文件上传处理

php

<?php
class SecureFileUploader {
    private $allowedTypes = [
        'image/jpeg' => 'jpg',
        'image/png' => 'png',
        'image/gif' => 'gif',
        'application/pdf' => 'pdf'
    ];
    
    private $maxSize = 10485760; // 10MB
    
    public function upload($file) {
        // 验证上传错误
        if ($file['error'] !== UPLOAD_ERR_OK) {
            throw new Exception('Upload error: ' . $file['error']);
        }
        
        // 验证文件类型（不依赖客户端提供的信息）
        $finfo = finfo_open(FILEINFO_MIME_TYPE);
        $mime = finfo_file($finfo, $file['tmp_name']);
        finfo_close($finfo);
        
        if (!isset($this->allowedTypes[$mime])) {
            throw new Exception('Invalid file type');
        }
        
        // 验证文件大小
        if ($file['size'] > $this->maxSize) {
            throw new Exception('File too large');
        }
        
        // 验证文件名安全
        $filename = $this->sanitizeFilename($file['name']);
        
        // 图像文件额外验证
        if (strpos($mime, 'image/') === 0) {
            $this->validateImage($file['tmp_name']);
        }
        
        // 生成安全的目标路径
        $extension = $this->allowedTypes[$mime];
        $newFilename = bin2hex(random_bytes(16)) . '.' . $extension;
        $destination = '/path/to/uploads/' . $newFilename;
        
        // 移动文件
        if (!move_uploaded_file($file['tmp_name'], $destination)) {
            throw new Exception('Failed to move uploaded file');
        }
        
        // 设置正确的文件权限
        chmod($destination, 0644);
        
        return [
            'original_name' => $filename,
            'saved_name' => $newFilename,
            'path' => $destination,
            'mime' => $mime
        ];
    }
    
    private function sanitizeFilename($filename) {
        // 移除路径信息
        $filename = basename($filename);
        
        // 移除危险字符
        $filename = preg_replace('/[^\w\.\-]/', '_', $filename);
        
        // 限制长度
        $filename = substr($filename, 0, 255);
        
        return $filename;
    }
    
    private function validateImage($path) {
        $imageInfo = getimagesize($path);
        
        if (!$imageInfo) {
            throw new Exception('Invalid image file');
        }
        
        // 检查图像尺寸限制
        if ($imageInfo[0] > 5000 || $imageInfo[1] > 5000) {
            throw new Exception('Image dimensions too large');
        }
    }
}
?>

4.3 安全日志与监控

php

<?php
class SecurityLogger {
    private $logPath;
    
    public function __construct($logPath = null) {
        $this->logPath = $logPath ?: __DIR__ . '/../logs/security.log';
        
        // 确保日志目录安全
        if (!is_dir(dirname($this->logPath))) {
            mkdir(dirname($this->logPath), 0755, true);
        }
    }
    
    public function logAttackAttempt($type, $details) {
        $entry = [
            'timestamp' => date('c'),
            'type' => $type,
            'ip' => $_SERVER['REMOTE_ADDR'] ?? 'unknown',
            'user_agent' => $_SERVER['HTTP_USER_AGENT'] ?? 'unknown',
            'request_uri' => $_SERVER['REQUEST_URI'] ?? 'unknown',
            'details' => $details,
            'session_id' => session_id() ? substr(session_id(), 0, 10) . '...' : 'none'
        ];
        
        $logLine = json_encode($entry) . PHP_EOL;
        
        // 写入日志文件
        file_put_contents($this->logPath, $logLine, FILE_APPEND | LOCK_EX);
        
        // 可选：发送警报到监控系统
        if (in_array($type, ['sql_injection', 'xss', 'bruteforce'])) {
            $this->sendAlert($entry);
        }
    }
    
    private function sendAlert($entry) {
        // 发送到Sentry、Logstash或SIEM系统
        $alertData = [
            'priority' => 'high',
            'message' => 'Security attack detected: ' . $entry['type'],
            'data' => $entry
        ];
        
        // 示例：发送到远程日志服务
        // $this->sendToRemote($alertData);
    }
    
    /**
     * 监控可疑活动
     */
    public static function monitorActivity() {
        $thresholds = [
            'login_attempts' => 5, // 5分钟内
            'form_submissions' => 20 // 每分钟
        ];
        
        $ip = $_SERVER['REMOTE_ADDR'];
        $now = time();
        
        // 检查登录尝试频率
        $loginKey = 'login_attempts_' . $ip;
        $attempts = self::getCounter($loginKey);
        
        if ($attempts >= $thresholds['login_attempts']) {
            self::logAttackAttempt('bruteforce', [
                'attempts' => $attempts,
                'timeframe' => '5min'
            ]);
            
            // 暂时阻止该IP
            self::blockIP($ip, 900); // 15分钟
        }
    }
}
?>

4.4 自动化安全测试

php

<?php
class SecurityTester {
    /**
     * 自动化SQL注入测试
     */
    public static function testSQLInjectionVulnerabilities($urls) {
        $payloads = [
            "' OR '1'='1",
            "'; DROP TABLE users; --",
            "1' UNION SELECT username, password FROM users --",
            "1 AND 1=1",
            "1 AND 1=2"
        ];
        
        $results = [];
        
        foreach ($urls as $url) {
            foreach ($payloads as $payload) {
                $testUrl = $url . '?id=' . urlencode($payload);
                $response = file_get_contents($testUrl);
                
                // 检测响应中的异常
                if (self::detectVulnerabilityIndicators($response)) {
                    $results[] = [
                        'url' => $url,
                        'payload' => $payload,
                        'vulnerable' => true
                    ];
                    break;
                }
            }
        }
        
        return $results;
    }
    
    /**
     * XSS漏洞扫描
     */
    public static function testXSSVulnerabilities($url, $parameters) {
        $xssPayloads = [
            '<script>alert(1)</script>',
            '\" onmouseover=\"alert(1)',
            '<img src=x onerror=alert(1)>',
            'javascript:alert(1)'
        ];
        
        $vulnerabilities = [];
        
        foreach ($parameters as $param) {
            foreach ($xssPayloads as $payload) {
                $data = [$param => $payload];
                $response = self::sendPostRequest($url, $data);
                
                if (strpos($response, $payload) !== false) {
                    $vulnerabilities[] = [
                        'parameter' => $param,
                        'payload' => $payload,
                        'type' => 'reflected_xss'
                    ];
                }
            }
        }
        
        return $vulnerabilities;
    }
    
    private static function detectVulnerabilityIndicators($response) {
        $indicators = [
            'You have an error in your SQL syntax',
            'MySQL server version',
            'Unclosed quotation mark',
            'sql',
            'query'
        ];
        
        foreach ($indicators as $indicator) {
            if (stripos($response, $indicator) !== false) {
                return true;
            }
        }
        
        return false;
    }
}
?>

第五章：持续安全与应急响应

5.1 安全开发生命周期集成

php

<?php
class DevSecOpsIntegration {
    /**
     * 预提交钩子安全检查
     */
    public static function preCommitChecks() {
        $checks = [
            'sql_injection' => self::checkForSQLInjection(),
            'xss_vulnerabilities' => self::checkForXSS(),
            'hardcoded_secrets' => self::checkForSecrets(),
            'dependency_vulnerabilities' => self::checkDependencies()
        ];
        
        foreach ($checks as $check => $result) {
            if ($result['failed']) {
                echo "Security check failed: {$check}\n";
                echo "Issues found: " . count($result['issues']) . "\n";
                exit(1);
            }
        }
        
        return true;
    }
    
    /**
     * 依赖项漏洞扫描
     */
    private static function checkDependencies() {
        $composerLock = json_decode(file_get_contents('composer.lock'), true);
        $vulnerabilities = [];
        
        foreach ($composerLock['packages'] as $package) {
            // 调用漏洞数据库API
            $vulnCheck = self::queryVulnerabilityDB($package['name'], $package['version']);
            
            if (!empty($vulnCheck['vulnerabilities'])) {
                $vulnerabilities[] = [
                    'package' => $package['name'],
                    'version' => $package['version'],
                    'vulnerabilities' => $vulnCheck['vulnerabilities']
                ];
            }
        }
        
        return [
            'failed' => !empty($vulnerabilities),
            'issues' => $vulnerabilities
        ];
    }
}
?>

5.2 应急响应计划

php

<?php
class IncidentResponse {
    private static $responseSteps = [
        'identification' => [
            '监控安全警报',
            '确认事件真实性',
            '评估影响范围'
        ],
        'containment' => [
            '隔离受影响系统',
            '阻止攻击源IP',
            '关闭漏洞入口点'
        ],
        'eradication' => [
            '清除恶意代码',
            '修复安全漏洞',
            '更新安全补丁'
        ],
        'recovery' => [
            '恢复系统功能',
            '验证修复效果',
            '监控异常行为'
        ],
        'lessons_learned' => [
            '分析根本原因',
            '改进安全措施',
            '更新响应计划'
        ]
    ];
    
    public static function handleSecurityIncident($type, $severity) {
        $logger = new SecurityLogger();
        $logger->logAttackAttempt($type, ['severity' => $severity]);
        
        switch ($severity) {
            case 'critical':
                self::activateResponseTeam();
                self::isolateSystems();
                self::notifyStakeholders();
                break;
                
            case 'high':
                self::patchVulnerability();
                self::resetCompromisedAccounts();
                self::enhanceMonitoring();
                break;
                
            case 'medium':
                self::schedulePatch();
                self::reviewLogs();
                self::updateFirewallRules();
                break;
        }
        
        return self::generateIncidentReport();
    }
}
?>